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Abstract 

Secure communication with feedback is studied. An 
achievability scheme in which the backward channel 
is used to generate a shared secret key is proposed. 
The scenario of binary symmetric forward and back- 
ward channels is considered, and a combination of the 
proposed scheme and Maurer's coding scheme is shown 
to achieve improved secrecy rates. The scenario of a 
Gaussian channel with perfect output feedback is also 
analyzed and the Schalkwijk-Kailath coding scheme is 
shown to achieve the secrecy capacity for this channel. 

1. Introduction 

In his pioneering work [T], Shannon introduced in- 
formation theoretic security and defined perfect se- 
crecy, which roughly refers to the case in which an 
enciphered cryptogram does not reveal any informa- 
tion to an eavesdropper about the underlying secret 
message. Shannon proved that perfect secrecy can be 
achieved with a shared secure key that is as long as 
the underlying message. Wyner showed in [5] that per- 
fect secrecy can be achieved even without key distri- 
bution if the cryptogram is transmitted over a noisy 
broadcast channel in which the eavesdropper's channel 
is physically degraded with respect to the legitimate re- 
ceiver's channel. This result was extended to more gen- 
eral broadcast channels in [3] , where it was shown that 
nonzero secrecy capacity can be achieved if the main 
channel is less noisy than the eavesdropper's channel. 
Secure communication in the presence of eavesdroppers 
has gained a recent interest, and information theoretic 
security in various models has been explored in detail 
(see, for example, [4], [5], [6] and [7]). 

While it is well-known that feedback doesn't in- 
crease the capacity of a point-to-point memoryless 
channel, it was observed in _8 that the availability of 
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feedback might increase the secrecy capacity of a point- 
to-point memoryless channel. This can be immediately 
seen by considering an infinite capacity secure feed- 
back link from the legitimate receiver to the legitimate 
transmitter. The feedback link can be used to trans- 
mit a secure key. This secure key can then be used to 
transmit the message securely over the forward channel 
via the one-time-pad coding scheme. Hence, an infinite 
capacity secure feedback channel allows the system to 
achieve a secrecy capacity equal to the forward chan- 
nel capacity as if the eavesdropper is not present. It 
is observed in [3] , [lOj that even public communication 
between the legitimate users can enhance the secrecy 
capacity. It has been shown that positive secrecy ca- 
pacity can be achieved through public communication 
even if the eavesdropper's forward channel is less noisy. 
In [2] and [10] upper and lower bounds for the per- 
fect secrecy capacity are provided in the case of public 
communication. These bounds match only for certain 
special cases. A feedback jamming scheme is also de- 
scribed in [llj for modulo additive channels. 

In this paper, we first propose an achievable secrecy 
scheme for a general wiretap channel model with feed- 
back (see Fig. [IJ , in which the forward channel from 
Alice to Bob and Eve and the backward channel from 
Bob to Alice and Eve are orthogonal broadcast chan- 
nels. The achievability of the proposed scheme follows 
from using the backward channel for generating a secret 
key shared by Alice and Bob and then using this secret 
key to transmit the message securely over the forward 
channel via the one-time-pad coding scheme. We then 
apply this secrecy scheme, in conjunction with Mau- 
rer's feedback coding technique [9], to a scenario with 
independent binary symmetric forward and backward 
channels. We explicitly describe the achievable secrecy 
rates of the proposed scheme and show the improve- 
ments in secrecy rate achieved with respect he feedback 
scheme for binary symmetric channels proposed in |12j . 

In the second part of this paper, we consider se- 
cret communication through a Gaussian wiretap chan- 
nel with perfect channel output feedback, i.e., Bob's 
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Figure 1: Wiretap channel with noisy feedback channel 
whose output can also be observed by the eavesdropper. 



noisy channel output is perfectly available to Alice in 
a casual manner. This system is consistent with the 
model considered in the Schalkwijk-Kailath (SK) [T5] 
scheme, where perfect causal feedback was shown to 
greatly simplify the achievability of the point-to-point 
link from Alice to Bob and also improve the error expo- 
nent by exploiting the perfect feedback link in this sce- 
nario. The SK scheme is a simple deterministic scheme 
which is easy to implement and analyze as opposed to 
Shannon theoretic random coding involving long code- 
words and high complexity encoding/decoding. We 
show that, in addition to all these attractive proper- 
ties, the SK scheme also achieves the secrecy capacity 
in the presence of an eavesdropper when the eavesdrop- 
per (Eve) receives a noisy observation of the feedback 
from Bob in addition to her own channel output from 
Alice as depicted in Fig. [H 

In the rest of the paper, we use AT" and Xf to 
denote the sequences (Ai, . . . , A„) and (A^, . . . , A„), 
respectively. We also define = max{x, 0}. 



g, : yy'^ X A;'-^ ^ Xb which map previous chan- 
nel outputs and the feedback inputs to the i-th feed- 
back input, i = 1, . . . ,n, and finally a decoder at Bob 
h : X X^^ — !■ W, which maps the channel outputs 
and the feedback inputs of Bob to the decoded message 
W. 

As usual, the block error probability of a code is 
defined as 



W=l 



while the equivocation rate is defined as 



1 



i?" = -H{W\Z'},Zl'' 
n •' 



(2) 



Definition 2.2 A secrecy rate R is achievable if there 
exists a sequence of (2"^,n) codes for which P" — s- 
as n goes to infinity and the equivocation rate satisfies 

R < lim i?^. 

n — *oo 

Definition 2.3 The secrecy capacity Csf in the pres- 
ence of feedback is the highest achievable rate R. 

3. An Achievable Secrecy Rate 

In the following theorem, we give a lower bound to 
the secrecy capacity in the presence of feedback. The 
achievability follows from using the backward channel 
for generating a secret key shared by Alice and Bob, 
and then using this secret key in the forward channel 
to increase the secrecy capacity of the forward channel. 



2. System Model and Definitions 

In the system shown in Fig. [U Alice wants to trans- 
mit a message e W to Bob over the discrete mem- 
oryless broadcast channel z/jx/), where Xf G Xf 
is Alice's channel input and Yf g y^ and Zf e Zf 
are the outputs at Bob and Eve, respectively. There 
is also an independent feedback channel p[yi,, zi,\xb), 
where A{, G Xi, is Bob's feedback channel input and 
Yb S yb and Zb £ Zb are the outputs at Alice and 
Eve, respectively. Here, subscripts '/' and '6' represent 
forward and backward channels, respectively. 

Definition 2.1 A (2"^,n) code for the above feed- 
back channel is composed of a message W uniformly 
distributed over set W = {1,...,2"^}, stochastic en- 
coders at Alice fi : W x yl^^ — » Xf which map the 
message and the previous feedback outputs to the i-th 
channel input, and stochastic feedback encoders at Bob 



Theorem 3.1 Rate Rs is achievable if, 

0<Rs< mm{I{Vf-Yf),I{Vf-Yf\Uf) ~ I{Vf;Zf\Uf) 

+I{Vb;Yb)-I{Vb;Zb)}, 

for some auxiliary random variables Uf, Vf, and 
Vb satisfying I{Uf;Zf) > I{Uf]Yf) with a joint 
distribution p{vb,Xb,yb, Zb,Uf,Vf,Xf,yf, Zf) = p{vb) 
■p{xb\vb)p{yb,zb\xb)p{uf)p{vf\uf)p{xf\vf)p{yf,zf\xf), 
i.e., Uf — > Vf — > Xf {Yf,Zf) and 

Vb-^Xb^{Yb,Zb). 

Proof: The achievability scheme is based on a sep- 
aration approach in the sense that. Bob uses the back- 
ward channel to generate a shared secret key of rate 
Rk, and then this shared key is used to transmit the 
message W over the direct channel. We can utilize a 
block based coding structure, where a secure key is gen- 
erated in the i-th block, i = 1, . . . ,B, and used in block 



i + 1, and the desired rate is achieved in the hmit of 
infinite blocks, i.e., as B oo. 

For simphcity, we give the proof for a con- 
stant Uf. Also, for given PvfXfYfZf, one 
can consider an auxiliary channel Pxf\Vf ^^^d 
the code for the induced channel PyfZflVf = 
'ExfPxj\Vfixf\vf)PYjZf\Xfiyf,Zf\xf). Hence, we 
prove the achievability of mm{I{X f;Yf), I{X f;Yf) — 
I{Xf- Zf) + /(T4; n) - HVb; Zb)}. The more general 
proof follows as in [3] . It is possible to generate a secret 
key Wk at rate 

Rk = iam{[I{Vb; n) - /(14; Zb)] + , liXf, Z f)}. 

over the backward channel [3] . From the perspective of 
the forward channel, the problem is now equivalent to 
finding the secrecy capacity of the broadcast channel 
with a secret key of rate Rk ■ 

Let Ri = I{Xf-Yf) - I{Xf-Zf). Gener- 
ate 2'^-^^^f-'^f ^ codewords independent identically dis- 
tributed (i.i.d.) with probability p(a;^) — n"=i?'(^/i)) 
and partition these codewords into 2"^^ codebooks 
which we name as Ci, . . . ,C2>iRi . Further divide each 
subcodebook Ci into 2"^*^ smaller codebooks, which 
are named as Ci_i, . . . , Cj 2"«fc ■ For each message w = 
[^1,^2], where wi S [l,2"^i] and W2 G [1,2"^'=], first 
generate W2 = W2 ® Wk mod(2"^'=), and transmit a 
codeword chosen uniformly random from the codebook 
,w'^ ■ Bob can correctly find (wi , ) , hence wi using 
the secret key, with high probability for large enough n. 
On the other hand. Eve can determine W2 and the code- 
word index within the smallest codebook, but cannot 
receive any information about wi. Moreover, no infor- 
mation about W2 is revealed to Eve as well, because w'2 
is uniformly distributed and independent of W2 ■ 

Corollary 3.2 // Bob's channel in the forward direc- 
tion and Alice 's channel in the backward direction are 
both less noisy then Eve 's, the highest secrecy rate 
achievable by the proposed scheme in Theorem \3.1\ can 
be simplified as 

R, < rmn{I{Xf-Yf)J{Xf-Yf)-I{X}-Zf) 
+ I{Xb;Yb)-I{Xb]Zb)}, 

for a joint distribution of the form p{xb) p{yb, Zb\xb) 

P{xf) P{yf:Zf\xf). 

4. Secrecy Rates for the Binary Symmetric 
Wiretap Channel with Feedback 

In this section, we focus on the secrecy rates when 
both the forward and the backward channels in Fig. [T] 
are independent binary symmetric channels (BSCs). 



The system model in this case is fully characterized 
by the four crossover probabilities e/, 5/, £(,, and Sb, 
corresponding to the channels Alice— s-Bob, Alice~>Eve, 
Bob— > Alice, and Bob— >Eve, respectively. 

This model is also analyzed in [T^] in which a se- 
crecy rate based on the transmission scheme proposed 
by Maurer in [9] is proposed: a random binary sequence 
x^ is transmitted by Bob over the backward channel. 
Assuming Alice's coded message is v'^, she transmits 
the modulo sum of with the received signal from 
the backward channel, i.e., xj = (By^ ■ If we assume 
that Alice can transmit xj over a noiseless channel, 
then Bob can reconstruct w" ® ® x^, while the best 
Eve can do is to reconstruct (By^ (BzJ^ . This is equiv- 
alent to a broadcast channel from Alice to Bob and Eve 
with cross-over probabilities and €b + Sb — ^e^Sb, re- 
spectively. 

We propose here to use a combination of Maurer's 
scheme with the proposed scheme in Section |3l The 
maximum secret key rate that can be generated using 
the feedback channel is = [h{Sb) — h{eb)]~^ . Bob uses 
the first an channel uses to generate a secret key of rate 
aCg, where < a < 1 is a design parameter that can 
be optimized according to the crossover probabilities in 
order to maximize the total secrecy rate. Bob transmits 
random bits in the rest of the feedback channel uses. 

In the forward channel, we first consider the case 
£/ < Sf. Alice divides the secret message into three 
parts, all of which are transmitted simultaneously. In 
the first part, Alice transmits a secret message of rate 

Rl = hi6f) - kief) 

over the forward channel using the usual secret coding 
scheme. Alice can simultaneously transmit a message 
at rate 1 — /i(e/) — i?f = 1 — h{df), which can be re- 
ceived by both Bob and Eve. Alice uses the secure key 
from the feedback channel as a one-time-pad to trans- 
mit securely to Bob at rate 

R'^ = mm{l - h{df),aC^,}. 

The remaining capacity of the forward channel is then 
1 - h{6f) - R'2 ^ [1 - h{6f) - aC,^] + . Finally, at this 
rate, Alice transmits a modulo summed message in the 
same manner as jl2|, using the random bits received 
from the second portion of the feedback channel. This 
transmission occurs at rate 

■{h{eb + Sb - 2eb6b) ~ h{eb)) 

In the case when ej > (5/ , it is impossible to have secret 
communication without feedback, hence Rf — 0. It is 
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Figure 2: Achievable secrecy rate of the proposed feed- 
back scheme with optimized a in binary symmetric 
channels. 



straightforward to show in this case that i?| = min{l — 
h{ef),aC^} and i?| = min{[l - /i(e/) - aC^]+,{l - 
a)}{h{eb + db — 2eb6b) — h{eb))- In both cases, the total 
secrecy capacity is then Rl + R2 + R^- 

To illustrate the gains through the proposed feed- 
back technique, we consider a system model with the 
same crossover probability in the forward and backward 
channels, i.e. e = e/ = e;, and 5 = 6f = 5b- In Fig. [21 
we plot the achievable secrecy rate by the proposed 
transmission scheme with optimized a as a function of 
e and 5. As opposed to not having feedback, or us- 
ing the whole feedback link to generate a secret key, 
this scheme can achieve positive secrecy rates even in 
(5 > e as we have partially incorporated Maurer's cod- 
ing scheme. Note also that, our achievable secrecy rates 
improve upon the ones reported in [12] . 

Figure [3] plots the improvement in the secrecy rate 
of the proposed feedback scheme with respect to the se- 
crecy capacity without feedback. Note that the secrecy 
capacity without feedback is Cs — [h{5) — h{()\^ . Inter- 
estingly, the largest gain is obtained at the point e = 
and h{5) = i, or (5 « 0.11. At this point the secrecy 
rate without feedback is = i, while with feedback 
we achieve Csf = 1, an improvement of one half bit. 
As (5 — !■ ^ from this point, the secrecy capacity without 
feedback increases towards one and feedback results in 
less improvement. 



5. Gaussian Wiretap Channel with Perfect 
Feedback 



Figure 3: Improvement in secrecy rate of the proposed 
feedback scheme with optimized a in binary symmet- 
ric channels with respect to secrecy capacity without 
feedback. 

Here, we consider a Gaussian wire-tap channel with 
feedback as seen in Fig. [H The forward channel at time 
index i is modeled as 

Y,^X, + N, and Z, = X, + M„ 

in which Ni and Mi are additive white jointly Gaus- 
sian noise terms with zero means. There is also an 
average power constraint P on Alice's transmission. 
We also have a perfect feedback channel from Bob's 
output to Alice that operates causally, i.e., at time in- 
stant i, Alice knows Bob's previous channel outputs 
— {Yi, . . . , Yi_i}. Eve, on the other hand, can 
only observe a noisy version of this feedback. The 
feedback from Bob to Alice, as overheard by Eve, is 
modeled as 



Yi — Yi -\- Si, 



(3) 



at time i, where Si is also white Gaussian with zero 
mean. We allow correlation among the additive noise 
terms of the network at each time instant. The covari- 
ance matrix of the noise terms iV, M and S is defined 
as 



PiaN(TM 



P2<^N'^S 
P3'^M<^S 

-I 



which is a real, non-negative definite matrix with a\,^ > 
0, ct| > and < 1, for i = 1, 2, 3. 

Alice's (potentially stochastic) encoding functions 
are now defined as ft : W x 3^*~^ X. We do not have 
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Figure 4: The Gaussian wiretap channel with perfect 
feedback to the legitimate transmitter. 



a channel encoder at Bob, and the perfect feedback 
scenario is equivalent to having Xi,.i — Y^^i — Yi and 
Zb^i = Yi. The average probability of error and the 
equivocation rate are as defined in Section [2l 

Ignoring the eavesdropper, the capacity from Al- 
ice to Bob (with or without feedback) is C/ = 

i log (l + ^) ■ This also serves as an upper bound 
on the secrecy capacity with feedback. The secrecy ca- 
pacity when there is no feedback is given by [8] 



1 



log 1 



P 



log 1 



p 



(4) 



if o-^ > alj. 



Note that Cs 

In [13], Schalkwijk and Kailath proposed a com- 
munication scheme (the SK scheme) for a Gaussian 
channel with perfect feedback that achieves the chan- 
nel capacity. The SK scheme is based on deterministic 
coding and parameter estimation. We first give a brief 
overview of the SK scheme using the notation of [14] . 

In the SK scheme, 2"^^ messages are mapped to 
a signal point by dividing the interval [—0.5,0.5] into 
2nB. gqyally spaced subintervals. The mid-point of each 
subinterval corresponds to a message. Let 6 be the 
signal point corresponding to the underlying message. 
At the first transmission, Xi — ai9 in transmitted, and 
Yi — aiO + Ni is received where ai is a constant to be 
chosen. The receiver forms an estimate of 6 based on 
its observation as 



ei^Xi 



Yi_ 

ai 



ai 



(5) 



The transmitter can also compute this estimate using 
the perfect feedback signal, and in the next transmis- 
sion, it transmits the estimation error at the receiver, 



i.e., X2 — a2{0 — 9i) — —a2^, where a2 is another 



pre-determined constant. The receiver computes 



X2 = 



Y2 
a2 



Yi_ 

ai 



N2 

Oi2 



(6) 



Using the two independent observations of in ([5]) 
and ([5]), the receiver forms 62 the maximum likelihood 
(ML) estimate of 9. Then the transmitter transmits 
^3 = 03(^ — ^2)7 where is another pre-determined 
constant. Repeating this process, we have 



X, = 
X, = 



Y 



l), 
and 



3=1 "i 



(7) 
(8) 

(9) 



where (|9]) is the maximum likelihood (ML) estimate 
of the parameter 6 at Bob from the observations 

y[i],...,yW. 

Now, on choosing — ja^^^ with 7 ~ ^/PjaJ^ 



and a I 



it can be shown that the error 



variance after n iterations is E[{0 — ^„)^] = ^rr- For 
M = 2"^, the probabihty of error, which corresponds 
to the probability of 0„ falling outside of the message 
interval, can be shown to decay to zero exponentially. 

In the following theorem, we show that the SK 
scheme also achieves the optimal secrecy capacity. 

Theorem 5.1 For the additive white Gaussian noise 
(AWGN) wire-tap channel with perfect feedback to the 
transmitter, the secrecy capacity is given by 

1 



C./=C/ = -log(^l + -2-j, (10) 
and this capacity can be achieved by the SK scheme. 



Proof: The converse is obvious since the rate in 
(fTO]) is the capacity of the feedback channel without 
secrecy constraints. Here we prove the achievability of 
the secrecy capacity in ([lU)) by the SK scheme. 

Fix W = {1, . . . , 2"-"}, where R = Csf- e, for some 
e > 0. Then we know that the average error probability 
goes to zero as n 00 for any e > with the SK 
scheme. 

From the SK scheme, we can observe that 



X, = 



^3=1 



and 



(11) 



^h^Y^^jN, (12) 



where we have defined hi = — — -. The observa- 

> 

tions at Eve are then given as Z\ = a\d + M\ and 

j-i 

= Qfi ^ hjNj + Mi, for i = 2, . . . , n. (13) 
Finally, the equivocation rate can be written as 

H(e\ziy^) > H{e\z^,Y{', m^"), (u) 

= H{e\ai6 + Afi, ai0 + ^1,52", A^", M2"), 
= i7(6'|ai6l + A/i,ai6l + S'i,iVi), (15) 

where ([14]) follows from the fact that conditioning re- 
duces entropy and (fT5|) follows since N2 and are 
independent of both 6 and ai^ + Afi due to i.i.d. chan- 
nel assumption. 

The equivocation rate can be further simplified as 

H{e\Z'l,Yl') > H{9\aie + Mi,aie + Si,Ni), 

= H{e) - I{0;ai9 + Mi,ai9 + Si,Ni), 

= nR- I{e;aie + Mi,aie + Si,Ni), 

= nR- I{e;Ae + B), 

where A = [0, ai, ai]-^, B = [Ni, Mi, Si]'^ , and where 
we have used the fact that the message is uniform over 
the set {1, . . . , 2"^}. The mutual information term in 
the final expression is difficult to calculate for a uni- 
formly distributed discrete 0, but we know that, al- 
lowing for an arbitrary distribution for 0, the mutual 
information is maximized for a Gaussian input distri- 
bution that has the same variance as 9. The variance 
9 as n goes to infinity is j^, hence the corresponding 
mutual information upper bound is given by 

I{9; A9 + B)<^ logdet + -^AA^E[BB'^]-i^ 
= ilogdet (^I+^AA^C-i) 

where 

ci = 2(p3 - piP2)crscrM + [p\ - 1)o-m + {pI - l)o-s ^nd 

C2= Pi+ pI+ pI- 2/91P2P3 - 1- 

Overall, we obtain 

-i/((?|z", r") > i? - J- log f 1 + , ^ 

= C,;-g-— log 1+ \' 2 

^Ci (17) 



as n ^ 00 and e ^ 0, if cr^j > 0, (t| > and C2 ^ 0. 

Note that, when there is no feedback, the secrecy 
capacity is nonzero only if aj^ < a\j. However, our re- 
sult shows that even if the eavesdropper's channel is less 
noisy than that of the legitimate receiver, the secrecy 
capacity can be made positive via perfect feedback. 
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